Security+ Log Analysis PBQ: A Real One, Walked Through
Log-analysis PBQs are the ones candidates find slowest, and it is almost never because the logs are hard. It is because they start reading at line one. This walks through the reading order that makes them quick, the handful of signatures that carry nearly all the marks, and a full worked example with the reasoning spelled out.
PBQs are the ones that eat your time. Practise them under pressure.
A full-length SY0-701 practice exam covering every domain, with PBQ-style items, an explanation on every question and a coach that names your weak concepts. The code applies itself when you create the account.
SECPLUS-EXAM-FULL
Redeem the code
Free, no credit card. Already have an account? Log in to start · New to PBQs? Start with the formats and strategy.
The three things that carry the signal
Almost every log-analysis PBQ resolves on one of these:
- Repetition. The same action many times in a short window. Brute force, spraying, scanning, exfiltration in chunks - all look like repetition before they look like anything else.
- Status and result codes. A run of failures followed by one success is the single most important pattern in security logging. HTTP 401/403 then 200. Windows 4625 then 4624.
- Anything that does not belong. SQL keywords in a URL.
../in a path. A login at 03:00 from a country the company does not operate in. An internal host talking to an external IP on a port nothing should use.
Signature reference
| What you see | What it is | The tell |
|---|---|---|
| Many failures, one account, one source | Brute force | Volume against a single target |
| Few failures each, many accounts | Password spraying | Stays under the lockout threshold - that is the point |
' OR 1=1 --, UNION SELECT, %27 | SQL injection | Database syntax where user input belongs |
../../etc/passwd, %2e%2e%2f | Directory traversal | Climbing out of the web root |
<script> in a parameter | XSS | Markup where text belongs |
| Sequential ports from one source | Port scan | Breadth, not depth |
| Same user, two countries, minutes apart | Impossible travel | Geography that cannot be true |
| Large regular outbound transfers to one IP | Exfiltration / C2 beaconing | Regularity - humans are not periodic |
| Account created, then added to admins | Privilege escalation / persistence | The order of the events |
A worked example
Here is the kind of excerpt a PBQ gives you. The scenario: a public-facing web application is behaving strangely. Review the logs and identify the attack, then state whether it succeeded.
Web server access log:
Reading it
- One source stands out.
10.20.x.xis internal and behaving normally.203.0.113.77is external and every one of its requests targets the same parameter. That is your actor. - Decode the encoding.
%27is a single quote,%20a space,%3Dan equals sign. So request two isid=14' OR '1'='1. Examiners URL-encode precisely to see whether you can still read it. - Follow the status codes - this is the answer. Three 500s, then 200. A 500 means the injected SQL broke the query. The attacker was column counting: two NULLs failed, three NULLs returned 200. They found the column count.
- The last line is the breach. Having matched the column count, they selected
username, password FROM users- and it returned 200 with 41,209 bytes, roughly ten times a normal page. Data left the building.
The follow-up you should expect
PBQs usually ask for a remediation as well. For this one, ranked as the exam would:
- Parameterised queries / prepared statements - the actual fix. It removes the class of bug rather than the instance.
- Input validation - useful defence in depth, but on its own it is a filter someone will eventually evade.
- WAF - buys you time today and belongs in the answer, but it is compensating control, not remediation.
- Least privilege on the database account - the web app did not need read access to a credentials table. This is what limits blast radius.
- Force a password reset and treat the credentials as compromised - because they are, and hashed does not mean safe.
If asked for the best single answer, it is parameterised queries. If asked for immediate containment, it is the WAF rule or blocking the source. Read which one the question wants - that distinction between fix and contain is a recurring theme.
A second pattern: authentication logs
The other common excerpt. Same method, different tells.
One source, one attempt each against different accounts - that is password spraying, not brute force. The distinction matters because it explains why account lockout did not fire: nobody crossed the threshold. Then a success, and twenty-two seconds later that account joins Domain Admins. Two events, two findings: initial access by spraying, then privilege escalation. The ordering is the story.
Under exam conditions
- Flag and move on if it is not resolving in two minutes. PBQs sit at the start and you can return to them. Candidates who sink fifteen minutes into the first one lose marks at the end of the paper they would have got for free.
- Answer partially rather than not at all. Multi-part PBQs are usually scored per part.
- Do not over-read. If the question asks which host is compromised, name it - do not also design the remediation in your head.
- Trust the abnormal, ignore the normal. Every excerpt contains legitimate traffic as camouflage. Internal hosts doing ordinary things are set dressing.
Reading one walkthrough is not the same as doing it on the clock
A full-length SY0-701 exam with PBQ-style items and an explanation on every question - plus a coach that tells you whether PBQs are actually your weak spot or whether something else is costing more. One-time purchase, lifetime access.
SECPLUS-EXAM-FULL
Redeem the code
Free, no credit card. Already have an account? Log in to start
Frequently asked questions
What is a log analysis PBQ?
A performance-based question showing one or more log excerpts - web, firewall, authentication or SIEM - asking you to identify what happened, classify the attack, or choose a response. It tests recognition from evidence rather than recall of a definition.
How do I answer one quickly?
Read the question first, then scan for repetition, status codes, and anything that does not belong in a normal request. Those three cover nearly every log PBQ on the exam.
How many PBQs are on the Security+ exam?
CompTIA does not publish a fixed number. Expect a handful at the start, within a maximum of 90 questions. They weigh more than a single multiple-choice item, and you can flag and return - usually the right move if one is eating your time.
What is the difference between brute force and password spraying in a log?
Brute force is many attempts against one account - high volume, single target. Spraying is a few attempts each against many accounts, deliberately staying under the lockout threshold. Same source IP, opposite shape.
How do I know if the attack actually succeeded?
Look for the transition. Failures then a success. Error codes then a 200. And check response size - a 200 returning ten times the normal byte count is data leaving. "It was attempted" and "it worked" are different answers, and the question usually wants the second.
Do I need to memorise log formats?
No. You need to read them. Know that a web log has source IP, timestamp, request and status code; that Windows 4625 is a failed logon and 4624 a successful one; and that URL encoding hides the interesting characters - %27 is a quote, %20 a space.